Privacy,
made clear.

Who we are

SafeBiteAI is operated by NECSCA LTD. For privacy questions, requests or complaints, email support@safebiteai.co.uk. NECSCA LTD is the data controller for account information and service requests we receive.

Information you choose to provide

Account information may include your email address, display name and Firebase user identifier. Household profiles may include a name or nickname, relationship and selected allergies or intolerances. Allergy information can be health data. Only add another person when you have their permission or authority to do so.

Information stored on your device

Household profiles, allergy choices, postcode, coordinates, selected stores, search radius, optional shopping-reminder branches, temporary store-visit state and eligible Open Food Facts product records are stored locally on your phone or in browser storage. Household and allergy information is not synchronised to a SafeBiteAI database. Your operating-system backup may include local app information according to your device and backup settings.

Location and nearby searches

During setup, you can allow foreground location so SafeBiteAI can detect your approximate area and postcode. If you later enter a different postcode, it is sent to Postcodes.io to obtain coordinates. Coordinates and search radius are sent to the Food Standards Agency hygiene-rating API to find nearby businesses and supermarket branches. If you separately enable Smart shopping reminders in the Family tab, SafeBiteAI then asks for background location and your device uses geofencing for up to 10 nearby branches belonging to retailers you selected. Geofence coordinates, branch identity, visits and movement history remain on your device and are not uploaded. SafeBiteAI does not continuously record your route. When you choose a venue photo or directions, SafeBiteAI opens its public business name, address or coordinates in Google Maps or Apple Maps.

Recall notifications

If you enable notifications, Firebase Cloud Messaging assigns the app installation a messaging token. SafeBiteAI stores that token, a random installation identifier and the supermarket identifiers you select in Firebase so recalls can be sent directly to matching devices. SafeBiteAI does not upload family names, allergen choices, scanned products or location for notification matching. Invalid messaging tokens are removed when Firebase reports that they can no longer receive messages.

Barcode and label checks

SafeBiteAI checks its on-device catalogue first. If a product is not available locally, the barcode is sent to Open Food Facts and eligible results may be stored on your device for later offline use. If Open Food Facts has no result, signed-in users may request an optional live product lookup through Firebase. Live fallback product details are displayed for that check only and are not added to SafeBiteAI’s database, local catalogue or recent-product history. A pending entry may be added to recent history and the SafeBiteAI review queue so an administrator can independently research and verify the product before adding a SafeBiteAI record. The queue stores the barcode, scan count, review status and, only during an active Smart shopping reminder visit, the retailer brand such as Tesco. It does not store the branch, coordinates, visit history, household or allergy information. Standard label scans are processed on your device. If you explicitly contribute an unresolved product label, SafeBiteAI saves the photo privately on your device when a reliable connection is unavailable and retries the upload when the app reconnects or is opened again. SafeBiteAI uploads the label photo, raw OCR label text, detected allergens and product-match evidence to Firebase for administrator review. After upload, the OCR text—not the photo—is sent through a Firebase Cloud Function to OpenAI to isolate explicitly printed ingredients and allergy warnings. The request uses store=false, and the result remains a suggestion requiring administrator verification. If automatic extraction fails, the original OCR text remains available to the administrator for manual review. The local copy is deleted after a successful upload. The Firebase photo and raw OCR text are retained while awaiting review and deleted after approval or rejection. Approved ingredient text, contribution status, points and badge progress may be retained; submissions never change product safety results automatically.

AI alternative ranking

Your device first removes alternatives with household allergen or trace conflicts. If you request AI ranking while signed in, only product details from that filtered shortlist are sent through an authenticated Firebase Cloud Function to the OpenAI API. Family names, allergy choices and location are not sent to OpenAI. Requests use store=false. OpenAI may retain API abuse-monitoring logs for up to 30 days under its applicable controls.

AI food assistant

When a signed-in user chooses the AI food assistant, the selected product photograph, their typed food question and a short product-only conversation are sent through an authenticated Firebase Cloud Function to the OpenAI API. SafeBiteAI does not send household names, allergy choices or location to OpenAI. Images are used to identify visible packaging and extract visible label evidence; they are not stored in a SafeBiteAI database. Requests use store=false. OpenAI may retain API abuse-monitoring logs for up to 30 days under its applicable controls. You can use barcode and on-device label checks without using this feature.

Why we use information

We use information to provide requested features, authenticate accounts, prevent abuse, remember local preferences and respond to support or privacy requests. For account and requested service processing, our UK GDPR basis is performance of our service contract. Where allergy information is processed, we ask for explicit consent because it may be special-category health data. You may withdraw consent by deleting the relevant profile or resetting SafeBiteAI.

Service providers and public data

• Google Firebase provides authentication, Cloud Functions, Cloud Firestore and Cloud Messaging.
• Apple provides Sign in with Apple and APNs notification delivery when selected.
• Open Food Facts provides product data under ODbL 1.0, individual contents under DbCL 1.0 and product images under CC BY-SA 3.0.
• UK Food Standards Agency hygiene data is used under the Open Government Licence.
• Postcodes.io supplies postcode coordinate data from listed open-data sources.
• OpenAI provides ingredient-text cleanup, optional product-image interpretation, food-assistant answers and product-ranking explanations.

Contains information from Open Food Facts, which is made available under the Open Database Licence. SafeBiteAI filters and reformats source records and offers its UK offline catalogue under ODbL 1.0. Food Standards Agency Crown copyright information is used under the Open Government Licence v3.0. See the full data licence and attribution notices.

Providers may receive network information such as your IP address and apply their own security, retention and international-transfer arrangements. Where a provider processes personal data for SafeBiteAI, we require protection consistent with this policy and applicable data-protection law and use limited to the agreed service.

International transfers

Some providers, including Firebase and OpenAI, may process personal data outside the UK, including in the United States. Where UK data-protection law restricts a transfer, we rely on the provider’s applicable safeguards, such as an adequacy decision, the UK International Data Transfer Addendum or approved contractual clauses. Contact us for more information about the safeguards relevant to your data.

Automated processing

SafeBiteAI uses rules to flag possible allergen conflicts and may use AI to interpret visible product images, answer product questions and rank alternatives. AI image analysis can be incomplete or incorrect and never guarantees that a food is safe. These results are informational suggestions only. They do not make decisions that produce legal or similarly significant effects, and you remain in control of every purchase and safety decision.

Retention

Local information remains until you delete profiles, delete your account, reset the app, clear browser storage or uninstall. SafeBiteAI retains missing or unverified barcodes until they are researched, resolved or no longer needed for catalogue improvement. Contributed label photos and raw OCR text are retained while awaiting review and deleted after approval or rejection; approved ingredient text, review outcomes, points and badge progress may be retained for catalogue integrity and reward records. Live external fallback product responses are not retained by SafeBiteAI. Recall installation records are updated while notifications remain enabled and invalid tokens are deleted when detected. Firebase account information remains while your account is active and for a limited period where needed for security, legal obligations or dispute handling.

Account deletion

Signed-in users can permanently delete their SafeBiteAI account from Family → Account connected → Delete account and app data. This deletes the Firebase Authentication account, removes that device’s recall registration and clears household profiles, allergy choices, location and preferences stored by SafeBiteAI on that device. It does not delete the user’s Google account or Apple ID. Contact support@safebiteai.co.uk if you need assistance.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, object to processing and receive portable copies of personal data, and to withdraw consent. Contact us to exercise a right. You may also complain to the UK Information Commissioner’s Office.

Children and family profiles

SafeBiteAI is designed for an adult account holder to manage household profiles. We do not ask for children’s dates of birth, addresses or medical records. Use a nickname where possible and only enter information you are authorised to manage.

Security and important limitations

We use platform security controls and authenticated Firebase services, but no system can guarantee absolute security. SafeBiteAI is an informational aid, not medical advice, and does not guarantee that a product or venue is safe. Always check current labels and speak to qualified professionals about allergy management.

Changes to this policy

We will update this policy when SafeBiteAI’s features or data practices change and show the new effective date. Material changes will be brought to users’ attention before new processing begins.